Input validation vulnerability in Elementor Addons, Widgets and Enhancements – Stax 1.4.3

The Stax plugin for WordPress, which adds extra features, widgets and tools for Elementor, is vulnerable to a type of attack called Cross-Site Request Forgery in versions up to and including 1.4.3. This is due to a lack of proper security checks, like a nonce validation, on the toggle_widget function. This means that unauthenticated attackers could enable or disable Elementor widgets if they can convince a website administrator to do something, like click on a link.